Do Not Sell or Share link: missing or not working

The rule

Under Section 1798.140(ad) and (ah), “sell” and “share” are not limited to payment, and the enforcement record treats advertising tags that send visitor data to third parties as sale or sharing. The statute applies to a “business” that does business in California and meets one of three thresholds: annual gross revenue above $25,000,000 as adjusted, buying, selling or sharing the data of 100,000 or more consumers or households, or earning 50 percent or more of revenue from selling or sharing. The CPPA’s inflation notice puts the revenue figure at $26,625,000 from 1 January 2025. The 100,000 threshold is the one a smaller site with a lot of traffic can cross.

The regulations fill in the link. Section 7013 asks for a conspicuous link in the header or footer of the homepage, and Section 7003(c) says a required website link “shall appear in a similar manner as other similarly-posted links used by the business on its homepage(s).”

A link that exists is not enough. Section 7026(a)(4) addresses a common shortcut in direct terms.

The statute states penalties in two places: administrative fines of up to $2,500 for each offence, or $7,500 for each intentional one and each one involving the data of consumers known to be under 16, in Section 1798.155(a), and civil penalties in the same amounts in Section 1798.199.90(a) for actions brought by the Attorney General. Both are inflation-adjusted. The CPPA’s notice puts them at $2,663 and $7,988 from 1 January 2025, and the next adjustment falls in January 2027. The Attorney General’s August 2022 Sephora announcement said the CCPA’s notice and cure provision would expire on 1 January 2023.

What PeekWell checks and how

US-02 is run where the site’s markets include California. It asks two questions: do trackers that point to sale or sharing appear on the page, and if so, is there a link that opens a working opt-out?

The scan is automated. It opens your public pages the way a first-time visitor’s browser would, with no choice saved, and notes any advertising or cross-site tracker that starts. Where it sees one, it looks for a link titled Do Not Sell or Share My Personal Information, sees where it leads, and checks that the page there has a form set up to send the request. A tracker with no link, a link that goes nowhere, or a page with no working form becomes a finding, and what the scan saw is the evidence.

Read the result with the alternatives in mind. The regulations allow a business to honour opt-out signals in a frictionless way instead of using the standard link, or to use the Alternative Opt-out Link, so a missing standard link is a prompt to check what the site does, not an answer on its own. US-03 covers the signal side.

The scan has limits, and the report says so. It sees the public pages it visited, and the members area when you give it a sign-in. It does not port-scan, try to get in where it isn’t allowed, run any security test or open addresses nobody linked to. Whether an opt-out actually stops the selling and sharing can’t be seen without sending a request, and the scan never sends one. So it checks the link, where it leads and that the form is set up to send. It doesn’t read your contracts, and it can’t see what a vendor does with the data it gets. Sharing that happens on a server is outside what a browser visit can see. A Passed means the expected behaviour was observed on the pages scanned. It does not say the site complies.

Why it matters for a company

In February 2026 the Attorney General announced a $2.75 million settlement with Disney. The allegation was that a visitor could use a toggle, a webform or a browser signal and the selling and sharing continued from other devices, services, or through third-party ad-tech code. Healthline’s settlement in July 2025 for $1.55 million turned on data that, the Attorney General said, kept going to advertising third parties after a consumer opted out. The CPPA’s Tractor Supply decision, announced on 30 September 2025, listed the lack of an effective opt-out mechanism among the allegations the company agreed to resolve by paying a $1,350,000 fine, alongside privacy notice failures.

The CPPA made the same point in its May 2025 Todd Snyder decision. The Enforcement Division alleged the company’s privacy portal was not configured so as to process opt-out requests for 40 days, and its head said that “using a consent management platform doesn’t get you off the hook for compliance.” The Stipulated Final Order the CPPA Board adopted on 27 February 2026 alleged that PlayOn’s phone and email opt-out methods did not reach the tracking technologies on its sites. PlayOn did not admit liability.

The link, the form behind it and the suppression that follows are three separate things, and the record shows gaps in each.

Smaller companies and larger companies

The rule is the same for every business that meets the thresholds. What changes is how the gap appears.

In a small business the site is often a template or hosted builder. Someone adds an advertising pixel for a campaign and a banner plugin goes on. No one adds the link, or it points to an email address, or it opens an empty page. The 100,000 consumers-or-households threshold depends on traffic, not revenue, so a small site can be in scope. We could not confirm a CCPA decision against a clearly small business. The closest listed case is federal: the FTC’s 2015 order against Nomi Technologies, whose privacy policy promised an opt-out in stores that never offered one.

In a larger business the difficulty is coverage. A tag manager holds dozens of tags owned by different teams, the company has several brands, apps and connected TV products, and the opt-out has to reach all of it. Disney is the example on the record. Each opt-out method worked in part, and none stopped everything.

How to fix it

1. List what shares data. In a private window with the network tab open, load the homepage and a few key pages. Write down every third-party advertising, retargeting and cross-site analytics request. Those are the tools the opt-out has to control.
2. Add the link with the exact title. Put “Do Not Sell or Share My Personal Information” in the footer of the homepage, styled like the other footer links. If you offer a combined choice with the sensitive-data link, label it so it is clear what it does.
3. Point it at a page that works. The page needs a form or control a visitor can use without an account or extra personal details. A cookie banner or an email address on its own does not address the selling and sharing.
4. Wire the request to the tags. When a visitor opts out, the advertising and cross-site tags have to stop for that browser, and the request has to reach your ad vendors and your tag manager rules. Test with a fresh browser after you submit it.
5. Cover every product. Apps, connected TV, other brands and logged-in accounts need the same result.
6. Honour the signal too. Websites are expected to accept a browser opt-out signal as well as offering a form. US-03 walks through that step.
7. Re-scan. Run a scan again once the link and suppression are live. The finding should clear when the link opens and the page behind it works.

Whether this meets the law for your business is a question for your legal adviser. Peeky reports only what it sees.